Appendix: Basic Steps for Using PGP

PGP Desktop is a security tool that uses cryptography to protect your data against unauthorized access.

PGP Desktop protects your data while being sent by email or by instant messaging (IM). It lets you encrypt your entire hard drive, so everything is protected all the time, or just a portion of your hard drive, on which you can securely store your most sensitive data. It also lets you put any combination of files and folders into an encrypted, compressed package for easy distribution or backup.

PGP Desktop lets you create PGP keypairs and manage both your personal keypairs and the public keys of others.

1. Install PGP Desktop on your computer.
   If you are a corporate user, your PGP administrator may have specific installation instructions for you to follow or may have configured your PGP
   installer with certain settings. Either way, this is the first step.
   
   
2. Run the Setup Assistant.
   The Setup Assistant will get you up and running by helping you to license PGP Desktop, create a keypair (if you don’t have one), publish your public key on the PGP Global Directory, enable PGP Messaging, and give you a quick overview of other features. If your PGP Desktop installer application was configured by a PGP administrator, there may be other activities that are part of the Setup Assistant.
   
   
3. Exchange public keys with others.
   After you have created a keypair, you can begin corresponding with other PGP Desktop users. You will need a copy of their public key and they will need yours. If you didn’t upload your public key to the PGP Global Directory using the Setup Assistant, you should do so now. The PGP Global Directory is also the first place you should look for the public keys of those persons to whom you want to send secure messages. When you are part of the PGP Global Directory, PGP Desktop will handle finding and verifying the keys of other PGP Desktop users automatically.
   
   
4. Validate the public keys you get from untrusted keyservers.
   When you get someone’s public key from an untrusted keyserver, you should attempt to make sure it has not been tampered with and that it really belongs to the purported owner. You do this by comparing the unique fingerprint on your copy of someone’s public key to the fingerprint on that person’s original key. Keys from trusted keyservers like the PGP Global Directory have already been verified.
   
   
5. Start securing your email, files, and IM sessions.
   After you have generated your keypair and have exchanged public keys, you can begin encrypting, signing, decrypting and verifying your email messages and files.
   
   
6. After you have sent or received some messages, check the messaging logs to make sure everything is working correctly.
   As you send and receive messages, notification windows will pop up from your Windows System tray telling you what PGP Desktop did. After you grow familiar with what happens to your inbound and outbound messages, you may turn these notifications off if you’d like. More detailed information on the operations performed on messages can be seen in the Messaging Log.
   
   
7. Modify your messaging policies, if necessary.
   Having correctly configured messaging policies means your email messages will be secured automatically and transparently. The default policies provide opportunistic encryption to anyone with a key published on the PGP Global Directory, and also provide a forced encryption mode if you include the text “[PGP]” in your Subject line; the message will not be sent if verified keys cannot be found.
   
   
8. Start using PGP Desktop’s other features.
   You can encrypt an entire drive using the PGP Whole Disk Encryption feature or just a portion of it using the PGP Virtual Disk feature, create a compressed and encrypted PGP Zip archive, or shred sensitive files you no longer need.

Now that we know a little bit about PGP Desktop, let’s go deeper into what you need to do to get started using it:

1. Install PGP Desktop on your computer.
   If you are a corporate user, your PGP administrator may have specific installation instructions for you to follow or may have configured your PGP installer with certain settings. Either way, this is the first step.
   
   
2. Run the Setup Assistant.
   The Setup Assistant will get you up and running by helping you to create a keypair (if you don’t have one) and publish your public key to the PGP Global Directory.
   
   
3. Exchange public keys with others.
   After you have created a keypair, you can begin corresponding with other PGP Desktop users. You will need a copy of their public key and they will need yours. If you didn’t upload your public key to the PGP Global Directory using the Setup Assistant, you should do so now. The PGP Global Directory is also the first place you should look for the public keys of those persons to whom you want to send secure messages.
   
   When you are part of the PGP Global Directory, PGP Desktop will handle finding and verifying the keys of other PGP Desktop users automatically.
   
   
4. Validate the public keys you get.
   When you get someone’s public key, you should attempt to make sure it has not been tampered with and that it really belongs to the purported owner. You do this by comparing the unique fingerprint on your copy of someone’s public key to the fingerprint on that person’s original key.
   
   
5. Start securing your email, files, and instant messaging.
   After you have generated your keypair and have exchanged public keys, you can begin encrypting, signing, decrypting and verifying your email messages and files.
   
   
6. After you have sent or received some messages, check the messaging logs to make sure everything is working correctly.
   
   As you send and receive messages, notification windows will pop up telling you what PGP Desktop did. After you grow familiar with what happens to your inbound and outbound messages, you may turn these notifications off if you would like. More detailed information on the operations performed on messages can be seen in the Messaging Log.
   
   
7. Modify your messaging policies, if necessary.
   Having correctly configured messaging policies means your email messages will be secured automatically and transparently. The default policies provide opportunistic encryption to anyone with a key published on the PGP Global Directory, and also provide a forced encryption mode if you include the text “[PGP]” in your Subject line where the message will not be sent if valid keys could not be found.
   
   
8. Start using PGP Desktop’s other features.
   You can encrypt a portion of your hard drive, create a compressed and encrypted PGP Zip archive, or shred files you no longer need.

Copyright © 1991–2005 by PGP Corporation. All Rights Reserved.